{"metadata": {"vulnerability": "CVE-2026-99252", "count": 13, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-25T10:25:14.403Z", "date_only": false, "value": "2026-09-25T10:25:14.403Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99252", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T11:20:12.192Z", "date_only": false, "value": "2026-11-03T11:20:12.192Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T11:27:26.416Z", "date_only": false, "value": "2026-11-03T11:27:26.416956Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117552266990492292", "record": "CVE-2026-99252", "field": "creation_timestamp", "uuid": "e0b900b8-494f-4fa7-abd8-c047606d3df6", "content": "CVE-2026-99252 io_uring/mpscq: disable preemption while pushing In the Linux kernel, the following vulnerability has been resolved:\nio_uring/mpscq: disable preemption while pushing\nA push makes the node the new tail, and then links it to its predecessor.In between the queue isn't empty, but mpscq_pop() can't get at the node.The consumers deal with that by trying again, with a cond_resched() inthe loop to give a preempted producer the chance to finish.\ncond_resched() doesn't do that if the consumer has a higher priority thanthe producer and both have to use the same CPU:\n  producer (SCHED_OTHER)              consumer (SCHED_FIFO), same CPU  io_req_local_work_add()    mpscq_push()      prev = xchg(&q->tail, node)  <preempted>                         io_cqring_wait()                                        __io_run_local_work()                                      again:                                          cond_resched()  // nothing to do                                          mpscq_pop()     // NULL                                          // work pending, no events yet                                          goto again\nThe producer can be any task that is able to queue task_work for thering: an io-wq worker, or somebody who sends a message withIORING_OP_MSG_RING. The consumer spins, holding ->uring_lock, until thescheduler takes pity on the fair class, which takes about a second withthe default settings of the fair server, and forever without it. Theloops in tctx_task_work_run() and io_cancel_local_task_work() have thesame problem.\nDon't allow preemption between the two steps. That bounds the time thewindow is open on the CPU of the producer by what interrupts take, and aconsumer that waits for that is on another CPU. The cost is apreempt_disable()/preempt_enable() pair per push.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99252https://git.kernel.org/stable/c/8c94677e2b6145393d4c129fe0f5364b0e5000a5#kernel #Linux#CVE_2026_99252#bot", "url": "https://infosec.exchange/users/cve/statuses/117552266990492292"}, {"timestamp": "2026-11-03T12:17:00Z", "date_only": false, "value": "2026-11-03T12:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99252", "record": "UBUNTU-CVE-2026-99252", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:17:31Z", "date_only": false, "value": "2026-11-03T12:17:31Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QF92-WX54-FH27", "record": "GHSA-QF92-WX54-FH27", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-03T12:17:31.890Z", "date_only": false, "value": "2026-11-03T12:17:31.890", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99252", "record": "FKIE_CVE-2026-99252", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T12:31:50Z", "date_only": false, "value": "2026-11-03T12:31:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QF92-WX54-FH27", "record": "GHSA-QF92-WX54-FH27", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T21:32:06Z", "date_only": false, "value": "2026-11-03T21:32:06Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QF92-WX54-FH27", "record": "GHSA-QF92-WX54-FH27", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-04T18:21:51.616Z", "date_only": false, "value": "2026-11-04T18:21:51.616Z", "kind": "other", "label": "Rejected", "source": "cvelistv5", "record": "CVE-2026-99252", "field": "cveMetadata.dateRejected"}, {"timestamp": "2026-11-04T18:21:51.616Z", "date_only": false, "value": "2026-11-04T18:21:51.616Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99252", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T18:21:51.616Z", "date_only": false, "value": "2026-11-04T18:21:51.616Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99252", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T19:17:42.063Z", "date_only": false, "value": "2026-11-04T19:17:42.063", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99252", "record": "FKIE_CVE-2026-99252", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-05T04:42:29Z", "date_only": false, "value": "2026-11-05T04:42:29Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99252", "record": "UBUNTU-CVE-2026-99252", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-07T19:45:05.855Z", "anchors": {"origin": {"timestamp": "2026-11-03T11:20:12.192Z", "date_only": false, "value": "2026-11-03T11:20:12.192Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T11:20:12.192Z", "date_only": false, "value": "2026-11-03T11:20:12.192Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 375893.663205, "hours": 104.41490644583332, "days": 4.350621101909722, "min_seconds": 375893.663205, "max_seconds": 375893.663205, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T11:20:12.192Z", "date_only": false, "value": "2026-11-03T11:20:12.192Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99252", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-07T19:45:05.855Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}